Low risk browser extensions

Döviz ve Altın Kurları posts built-in Altinkaynak SOAP credentials to an HTTP data service when its popup loads.

E Money Network exposes its persistent analytics ID and install timestamp to any website through its wallet bridge.

EH Assistant Tool for Shopee sends your Shopee account ID to licensing.ehict.com during page setup.

ENHYPEN Current Wallpapers New Tab sends Chrome topSites URLs to Google's favicon service.

ESUIT Anti Popup Comments for Facebook removes Content-Security-Policy headers on Facebook and esuit pages.

ESUIT | Comments Exporter for Instagram removes Content-Security-Policy headers on Instagram and esuit.dev pages.

ETA pdf & Excel lets ETA portal pages read and replace all extension sync storage through its page bridge.

Elementor Width Display sends entered license keys to licenca.eliasferreira.com.br for activation and status checks.

EqualFill lets page-generated equals-key events trigger requests to local helper services.

Excel to PDF Converter opens its converter site over cleartext HTTP when installed or clicked.

Export Zillow data to Excel sends stored usernames to turtletasks.com to check account access.

Eye-Able Assist injects a hidden page marker that lets websites detect the extension while pages load.

FC Barcelona Mosaic Live Wallpaper sends custom shortcut URLs to Google when it loads missing shortcut icons.

Fat cat picture batch download can route Chrome update checks through agency.pictureknow.com.

Final Fantasy 7 Remake Wallpaper sends top-site URLs from its new tab page to Google's favicon service.

Forge removes GitHub page security headers on main-frame and sub-frame loads.

Free Turbo Comment Export Tool sends Instagram commenter avatar URLs to igimg.hubext.com during comment export.

Freelancer Helper sends project details and profile fields to freelancerhelper.click when generating AI bids.

GA4 Enhanced DebugView sends scoped DebugView URLs and a persistent client ID to Google Analytics.

GPT Formula exposes an OAuth callback that accepts URL-fragment tokens from any web page and stores them locally.

GenAlt sends user-selected image URLs to Azure Computer Vision and caches generated captions in Supabase.

Genius Connector sends login credentials and a browser-derived device ID to app.kyubi.io during sign-in.

Geoguessr Helper can send captured tab screenshots to OpenAI after accepting lookalike Geoguessr origins.

Getaway Shootout - Unblocked 66 sends sandboxed game-page cookie and storage key names to t.poki.io.

Gladiatus Bot - Gladbot injects remote license announcements into Gladiatus pages without sanitizing the HTML.

GlobiMail for Podio executes JavaScript commands returned by secure.globimail.com on Podio and GlobiFlow pages.

Gojo Infinity Live Wallpaper New Tab sends custom shortcut URLs to Google's favicon service.

Google AI Citation Analysis opens an update page that clicks a YouTube subscription link after user dwell and scroll.

Google App Launcher loads a Google Fonts stylesheet from its popup.

Google Dark Theme loads a Flaticon SVG from image.flaticon.com on matching Google pages.

Google Gemini Sidepanel - Tabbee removes Gemini frame and Content-Security-Policy protections after permission is granted.

Grammarlyier loads Google Fonts, Cloudflare CDN styles, and i.ibb.co images when its popup opens.

HEIC to JPG & PNG Converter loads Google Fonts and an MTS font from its popup/options page.

Halloween Wallpaper sends Chrome top-sites URLs to Google's favicon service on each new-tab page.

Hello Kitty Live Wallpaper loads Google Fonts resources whenever its custom new-tab page opens.

Hero Wallet provides a browser crypto wallet bridge without confirmed data-recipient findings.

High contrast mode - Dark mode - Eye protection applies page-wide visual filters and sends extension usage events to analytics services.

Historical U.S. Counties Auto-Checker sends genealogy-site page URLs, titles, and referrers to Google Analytics.

Hoopla Extension reports checkout coupon activity, merchant hostnames, coupon codes, and cart totals to BestToolbars analytics.

Horse Wallpaper New Tab with Facts lets horsestab.com pages read your Chrome top-sites list.

Houzz Pro CRM for Gmail sends InboxSDK telemetry from Gmail pages to Google Pub/Sub.

Hummingbird Hover-Graph opens Tactical Arbitrage pages over cleartext HTTP on install and in its options page.

IG HERO智能插件 follows, unfollows, likes, and blocks Instagram accounts directed by the-ins-club.com.

ITONICS Web Clipper Enterprise inserts an extension resource URL into every page it runs on.

ITV Kerching embeds OAuth client credentials and sends signed token requests to api-partners.kindred.co.

Image editor PaintMagick for photos sends visited image URLs to RedCoolMedia when you open image files.

ImageXtract - Copy Text from Image lets any website invoke its OCR engine and receive recognized text from supplied images.

Impersonator lets any webpage request stored Ethereum RPC URLs for configured chains.

Inboxes sends a browser fingerprint to api.inboxes.app when it creates or profiles an account.

Input Translator sends focused form text to Google Translate when its all-sites shortcut is triggered by page-dispatched events.

Instagram Cookie Login loads remote HTML into its Instagram cookie-entry popup.

Is Generated - Block AI Content sends visited HTTPS page URLs with a client ID to server.isgenerated.com.

JSON Diff sends user-entered web URLs to jsondiff.com when fetching comparison input.

JSONView temporarily routes Chrome update checks through agency.pictureknow.com when its version probe fails.

JSX Tool lets any webpage trigger its background script to open a localhost WebSocket connection.

JoyLink reads Walmart Creator bonus payout progress from the page and sends it to api.joylink.io.

JoyTab - Your News Tab sends Chrome top-sites URLs to api.statvoo.com for favicon lookups.

JustParty sends visited page URLs, titles, and referrers from ordinary websites to Google Analytics.

Kakao Pixel Helper sends discovered Kakao Pixel track IDs to a Daum Kakao API over cleartext HTTP.

KeyGuard - Password Manager lets approved sites and any localhost page read its login token and derived stashword.